News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 20 |
| Tue 27 Oct | 95 | 18 |
| Today, Wed 28 Oct | 81 so far | 15 |
Developing
Tue 27 May 202577 articles
- DragonForce ransomware abuses SimpleHelp in MSP supply chain attack
The DragonForce ransomware operation successfully breached a managed service provider and used its SimpleHelp remote monitoring and management (RMM) platform to steal data and deploy encryptors on downstream customers' systems. [...]
BleepingComputer - DragonForce ransomware abuses MSP’s SimpleHelp RMM to encrypt customers
The DragonForce ransomware operation successfully breached a managed service provider and used its SimpleHelp remote monitoring and management (RMM) platform to steal data and deploy encryptors on downstream customers' systems. [...]
BleepingComputer - DragonForce operator chained SimpleHelp flaws to target an MSP and its customers
Sophos warns that a DragonForce ransomware operator chained three vulnerabilities in SimpleHelp to target a managed service provider. Sophos researchers reported that a DragonForce ransomware operator exploited three chained vulnerabilities in SimpleHelp…
Security Affairs - Adidas Falls Victim to Third-Party Data Breach
Though Adidas said that no payment or financial information was affected in the breach, individuals who contacted the compamy's customer service help desk were impacted.
Dark Reading - Zscaler to Acquire MDR Specialist Red Canary
Zscaler signals a big push into the security-operations market with the announcement of plans to buy Denver-based Red Canary.
SecurityWeek - CISA Warns of Attacks Targeting Commvault SaaS Environment
A threat actor has gained access to Microsoft 365 environments of a small number of customers of Commvault's Metallic service.
Dark Reading - DragonForce Ransomware Strikes MSP in Supply Chain Attack
DragonForce, a ransomware "cartel" that has gained significant popularity since its debut in 2023, attacked an MSP as part of a recent supply chain attack, via known SimpleHelp bugs.
Dark Reading - Iranian pleads guilty to RobbinHood ransomware attacks, faces 30 years
An Iranian national has pleaded guilty to participating in the Robbinhood ransomware operation, which was used to breach the networks, steal data, and encrypt devices of U.S. cities and organizations in an attempt to extort millions of dollars over a…
BleepingComputer - Iranian Man Pleads Guilty to Role in Baltimore Ransomware Attack
Sina Gholinejad pleaded guilty to computer-fraud and wire-fraud-conspiracy charges linked to the Robbinhood ransomware hit on Baltimore.
SecurityWeek - Iranian Man Pleaded Guilty to Role in Robbinhood Ransomware
From the U.S. Department of Justice: An Iranian national pleaded guilty today to participating in an international ransomware and extortion scheme involving the Robbinhood ransomware. According to court documents and statements made in court, Sina…
DataBreaches - MathWorks, Creator of MATLAB, Confirms Ransomware Attack
The attack dirsupted MathWorks' systems and online applications, but it remains unclear which ransomware group targeted the software company and whether they stole any data.
Dark Reading - FBI: Silent Ransom Group Adopts Vishing Campaign Against Law Firms
The non-ransomware extortion group has switched up tactics and victimology in a deliberate and focused campaign similar to those of other attackers focused on stealing sensitive data.
Dark Reading - New Self-Spreading Malware Infects Docker Containers to Mine Dero Cryptocurrency
Misconfigured Docker API instances have become the target of a new malware campaign that transforms them into a cryptocurrency mining botnet. The attacks, designed to mine for Dero currency, is notable for its worm-like capabilities to propagate the malware…
The Hacker News - How the New Hacker Millionaire Class Was Built
Once dismissed as Internet miscreants in hoodies, ethical hackers have hit the big time, earning millions from blue-chip firms. And they say it's their diverse backgrounds that make them top-tier bug hunters.
Dark Reading - The future of AI agents—and why OAuth must evolve
I believe we’re at the beginning of something extraordinary. Today’s AI agents are already impressive—they’re helping software engineers write code, assisting site reliability teams in troubleshooting systems, and handling a variety of analytical tasks. Yet,…
techcommunity.microsoft.com - Danabot Takedown Deals Blow to Russian Cybercrime
A multiyear investigation by a public-private partnership has resulted in the seizure of the botnet's US-based infrastructure and indictments for its key players, significantly disrupting a vast cybercriminal enterprise.
Dark Reading - Threat Actors Use Fake DocuSign Notifications to Steal Corporate Data
DocuSign has emerged as a cornerstone for over 1.6 million customers worldwide, including 95% of Fortune 500 companies, and boasts a user base exceeding one billion. However, this widespread adoption has made DocuSign a prime target for cybercriminals.…
gbhackers.com - DragonForce Ransomware Hackers Exploiting SimpleHelp Vulnerabilities
Sophos warns that a DragonForce ransomware operator chained three vulnerabilities in SimpleHelp to target a managed service provider.
SecurityWeek - 184 million logins for Instagram, Roblox, Facebook, Snapchat, and more exposed online
A recent discovery by cybersecurity researcher Jeremiah Fowler of an unsecured database containing over 184 million unique login credentials has once again highlighted the growing threat posed by infostealers. While the sheer volume of exposed data—including…
Malwarebytes - Russian Government Hackers Caught Buying Passwords from Cybercriminals
Microsoft flags a new Kremlin hacking team buying stolen usernames and passwords from infostealer markets for use in cyberespionage attacks.
SecurityWeek - Russia-linked APT Laundry Bear linked to 2024 Dutch Police attack
A new Russia-linked APT group, tracked as Laundry Bear, has been linked to a Dutch police security breach in September 2024. Netherlands General Intelligence and Security Service (AIVD) and the Netherlands Defence Intelligence and Security Service (MIVD)…
Security Affairs - Not Every CVE Deserves a Fire Drill: Focus on What’s Exploitable
Not every "critical" vulnerability is a critical risk. Picus Exposure Validation cuts through the noise by testing what's actually exploitable in your environment — so you can patch what matters. [...]
BleepingComputer - Government Calls on Organizations to Adopt SIEM and SOAR Solutions
In a landmark initiative, international cybersecurity agencies have released a comprehensive series of publications to guide organizations through the implementation and prioritization of Security Information and Event Management (SIEM) and Security…
gbhackers.com - Ongoing Campaign Uses 60 NPM Packages to Steal Data
Security firm Socket warns flags a campaign targeting NPM users with tens of malicious packages that can hijack system information.
SecurityWeek - Cybercriminals Clone Antivirus Site to Spread Venom RAT and Steal Crypto Wallets
Cybersecurity researchers have disclosed a new malicious campaign that uses a fake website advertising antivirus software from Bitdefender to dupe victims into downloading a remote access trojan called Venom RAT. The campaign indicates a "clear intent to…
The Hacker News - WordPress TI WooCommerce Wishlist Plugin Flaw Puts Over 100,000 Websites at Risk of Cyberattack
A severe security flaw has been identified in the TI WooCommerce Wishlist plugin, a widely used WordPress extension with over 100,000 active installations. This plugin enables WooCommerce store owners to integrate wishlist functionality into their online…
gbhackers.com - CVE Uncertainty Underlines Importance of Cyber Resilience
Organizations need to broaden their strategy to manage vulnerabilities more effectively and strengthen network cyber resilience.
Dark Reading - Microsoft Alerts on Void Blizzard Hackers Targeting Telecommunications and IT Sectors
Microsoft Threat Intelligence Center (MSTIC) has issued a critical warning about a cluster of global cloud abuse activities orchestrated by a threat actor tracked as Void Blizzard, also known as LAUNDRY BEAR. Assessed with high confidence to be…
gbhackers.com - Dutch Intelligence Agencies Say Russian Hackers Stole Police Data in Cyberattack
The agencies said that the group, which they called Laundry Bear, is actively trying to steal sensitive data from EU and NATO countries and is “extremely likely Russian state supported.”
SecurityWeek - Hackers Use Fake OneNote Login to Capture Office365 and Outlook Credentials
A recent investigation by security analysts has uncovered a persistent phishing campaign targeting Italian and U.S. users, utilizing a chain of free cloud platforms and Telegram bots for credential harvesting and data exfiltration. The attack typically…
gbhackers.com - MATLAB dev confirms ransomware attack behind service outage
MathWorks, a leading developer of mathematical computing and simulation software, has revealed that a recent ransomware attack is behind an ongoing service outage. [...]
BleepingComputer - Hackers Exploit Craft CMS Vulnerability to Inject Cryptocurrency Miner Malware
Threat actors have exploited a critical Remote Code Execution (RCE) vulnerability, identified as CVE-2025-32432, in the Craft Content Management System (CMS). Discovered by Orange Cyberdefense in mid-February 2025 and publicly disclosed on April 25, 2025,…
gbhackers.com - APT36 and Sidecopy Hackers Target India’s Critical Infrastructure with Malware Attacks
Seqrite Labs, India’s largest malware analysis facility, has uncovered a sophisticated campaign dubbed Operation Sindoor, orchestrated by Pakistan-aligned threat groups APT36 and Sidecopy. Launched on May 7, 2025, this state-sponsored Advanced Persistent…
gbhackers.com - Inside the $111 Billion Cloud Security Market: Acquisition, Expansion, and Where to Aim Next
As cloud security spending surges to $111 billion, new data highlights Microsoft's dominance, the U.S. market's outsized role, and Google's strategic acquisition of Wiz.
SecurityWeek - Windows 11 Notepad Introduces AI-Powered Writing with Copilot Integration
Microsoft’s venerable Notepad, a staple of Windows since the 1980s, is undergoing its most significant transformation yet. With the latest Windows 11 Insider builds, Notepad now features integrated generative AI, turning the once-basic text editor into a…
gbhackers.com - Iranian Cybergroup Toufan Targets Organizations to Steal Login Credentials
A pro-Palestinian cybergroup called Cyber Toufan, which means “cyber storm,” has become a serious threat to Israeli groups in the changing digital battlefield of the Israel-Gaza war. Over the past year, this ideologically driven group has orchestrated over…
gbhackers.com - Velvet Chollima APTHackers Target Government Officials Using Weaponized PDFs
The DPRK-linked Velvet Chollima Advanced Persistent Threat (APT) group has launched a sophisticated cyberattack campaign targeting South Korean government officials, as well as NGOs, government agencies, and media organizations across North America, South…
gbhackers.com - Russian Hackers Breach 20+ NGOs Using Evilginx Phishing via Fake Microsoft Entra Pages
Microsoft has shed light on a previously undocumented cluster of threat activity originating from a Russia-affiliated threat actor dubbed Void Blizzard (aka Laundry Bear) that it said is attributed to "worldwide cloud abuse." Active since at least April…
The Hacker News - Mozilla Quickly Fixes Firefox Vulnerabilities from Pwn2Own 2025 with Urgent Patches
At this year’s Pwn2Own Berlin, security researchers successfully demonstrated two new zero-day exploits against Mozilla Firefox, targeting the browser’s content process. The vulnerabilities—CVE-2025-4918 and CVE-2025-4919—were both found in Firefox’s…
gbhackers.com - Unpatched & Critical (CVSS 10): TI WooCommerce Wishlist Vulnerability Affects 100K+ Sites
Researchers have discovered a critical security vulnerability in the TI WooCommerce Wishlist plugin, a widely-used tool that powers
SecurityOnline